Supabase email not sent: "Email address not authorized"

Guide · October 21, 2026

Supabase sign-up returns Email address not authorized, or the confirmation email simply never arrives for real users while it works for you. That is the built-in email service doing what it is designed to do: it only sends to your own team. The fix is to connect your own SMTP provider.

Supabase's docs say it directly: "Unless you configure a custom SMTP server for your project, Supabase Auth will refuse to deliver messages to addresses that are not part of the project's team."

Sources: Supabase: Send emails with custom SMTP and Supabase changelog: changes to the default email provider. Checked October 21, 2026.

Stuck on this right now? Paste your error and we'll email you the likely cause within 24 hours, free.

What it looks like

supabase.auth.signUp() returns an error with the message Email address not authorized.
Sign-up "succeeds" in your Lovable app, but the user never gets the confirmation email and can't log in.
Magic links, password resets or invites work for your own address and fail for everyone else.
A few emails go out, then nothing for a while: the default service's rate limit.

Test with an address that is not on your Supabase organization's team. Your own address will keep working and hide the bug.

Why it happens

Every Supabase project starts on a shared SMTP server meant for trying things out. Its docs list the limits:

Team addresses only. If your organization's members are person-a@example.com and person-b@example.com, those are the only inboxes Auth will mail. "All other addresses will fail with the error message Email address not authorized."
A tiny rate limit. "Currently this value is set to 2 messages per hour," and Supabase says it can change without notice.
No delivery guarantee. It is best-effort and, in Supabase's words, "not meant for production use."

This covers every Auth email, not just sign-up confirmation: magic links, one-time codes, invites, email change and password reset.

The fix: connect your own SMTP

Pick a provider. Supabase names Resend, AWS SES, Postmark, Twilio SendGrid, ZeptoMail and Brevo as examples. Any service that offers SMTP works.
Verify a sending domain there. Add the SPF, DKIM and DMARC records your provider gives you. Use something like no-reply@auth.yourdomain.com as the From address.
Enter the SMTP settings in Supabase. In your project's Authentication settings, enable custom SMTP and fill in host, port, user, password, sender email and sender name. Save.
Raise the rate limit. Supabase starts custom SMTP at "a low rate-limit of 30 messages per hour." Adjust it on the Auth rate limits page to fit your sign-up volume.
Test with a non-team address. Sign up with a fresh Gmail or Outlook address and check spam too.

The values you need from your provider

Host:          smtp.yourprovider.com
Port:          587   (or the port your provider documents)
Username:      from your provider
Password:      an SMTP password or API key
Sender email:  no-reply@auth.yourdomain.com
Sender name:   Your App

Don't "fix" it by turning off confirmation

Turning off email confirmation makes sign-up appear to work, but it doesn't solve the problem. Supabase's changelog warns that password reset keeps sending email, and on the default service those messages reach only your organization's members, so "the forgot password / reset password flow will be broken for your project." It also lets anyone register with an address they don't own.

Still not arriving after custom SMTP?

Still seeing "not authorized": custom SMTP isn't enabled or wasn't saved. Recheck the toggle.
"Error sending confirmation email": Supabase reached your SMTP server and it refused. Check the Auth logs for the provider's response: usually wrong credentials or an unverified From domain.
Lands in spam: finish SPF, DKIM and DMARC, keep Auth emails plain, and don't reuse your marketing domain.
Link opens localhost or the preview: that's Site URL, not SMTP. See Lovable authentication errors in preview vs production.

Quick checklist

Test with an address outside your Supabase team.
Custom SMTP enabled and saved in Authentication settings.
Sending domain verified with SPF, DKIM and DMARC.
Auth email rate limit raised above 30/hour if you expect more sign-ups.
Email confirmation still on.
Site URL points at production, so links open the live app.

Questions

Why does Supabase say Email address not authorized?

Your project is still on Supabase's default SMTP service. Without custom SMTP, Supabase Auth only delivers to addresses that are members of the project's organization team. Every other address fails with Email address not authorized.

Why does sign-up work for me but not for my users?

You are on the team, so the default service mails you. Your users are not, so their confirmation, magic link and reset emails are refused. Testing only with your own address hides the problem until launch.

Does turning off email confirmation fix it?

Not fully. Password reset, magic links and invites still send email, and on the default service those only reach team members. Set up custom SMTP instead of lowering your security settings.

Why do only a couple of emails an hour go out?

The default service has a small rate limit that Supabase says can change; its docs currently list 2 messages per hour. After you configure custom SMTP, Supabase starts you at 30 per hour, which you can raise in the Auth rate limits settings.

Which SMTP provider should I use?

Any provider that speaks SMTP works. Supabase lists Resend, AWS SES, Postmark, Twilio SendGrid, ZeptoMail and Brevo as examples. Verify your sending domain with the provider (SPF, DKIM, DMARC) before going live.

Sign-up still broken? Tell us what the user sees and what your Auth logs say.

Get auth fixed

Still stuck? Paste the error and we'll email you the likely cause, free.